This paper presents a novel deep learning based method for automatic malware
signature generation and classification. The method uses a deep belief network
(DBN), implemented with a deep stack of denoising autoencoders, generating an
invariant compact representation of the malware behavior. While conventional
signature and token based methods for malware detection do not detect a
majority of new variants for existing malware, the results presented in this
paper show that signatures generated by the DBN allow for an accurate
classification of new malware variants. Using a dataset containing hundreds of
variants for several major malware families, our method achieves 98.6%
classification accuracy using the signatures generated by the DBN. The
presented method is completely agnostic to the type of malware behavior that is
logged (e.g., API calls and their parameters, registry entries, websites and
ports accessed, etc.), and can use any raw input from a sandbox to successfully
train the deep neural network which is used to generate malware signatures.

本文提出了一种基于深度学习的自动生成和分类恶意软件签名的方法，使用深度置信网络 (DBN) 生成恶意软件行为的不变紧凑表示。通过使用 DBN 生成的签名，本方法使用包含数百个变体的数据集，对几个主要恶意软件家族的新变体实现了 98.6% 的分类准确率。

DeepSign：用于自动恶意软件签名生成与分类的深度学习

DeepSign: Deep Learning for Automatic Malware Signature Generation and  Classification

Android, the most popular mobile OS, has around 78% of the mobile market
share. Due to its popularity, it attracts many malware attacks. In fact, people
have discovered around one million new malware samples per quarter, and it was
reported that over 98% of these new malware samples are in fact "derivatives"
(or variants) from existing malware families. In this paper, we first show that
runtime behaviors of malware's core functionalities are in fact similar within
a malware family. Hence, we propose a framework to combine "runtime behavior"
with "static structures" to detect malware variants. We present the design and
implementation of MONET, which has a client and a backend server module. The
client module is a lightweight, in-device app for behavior monitoring and
signature generation, and we realize this using two novel interception
techniques. The backend server is responsible for large scale malware
detection. We collect 3723 malware samples and top 500 benign apps to carry out
extensive experiments of detecting malware variants and defending against
malware transformation. Our experiments show that MONET can achieve around 99%
accuracy in detecting malware variants. Furthermore, it can defend against 10
different obfuscation and transformation techniques, while only incurs around
7% performance overhead and about 3% battery overhead. More importantly, MONET
will automatically alert users with intrusion details so to prevent further
malicious behaviors.

本文提出了一种针对 Android 恶意软件的检测框架 MONET，该框架结合了恶意软件的运行行为和静态结构来检测恶意软件变种，并通过两种新颖的拦截技术实现了轻量级行为监测和签名生成，能够在 7% 的性能开销和 3% 的电池开销下，达到 99% 的检测精度和防御各种混淆和变换技术的效果，并自动提醒用户以防止进一步的恶意行为。